Module 4 · Windows Event Log Forensics — The IR Reference

Why this module exists. The defender’s biggest leverage in any Windows IR is the event log. The attacker’s biggest leverage in the same IR is knowing which events to clear. This module gives you the canonical event IDs, the queries that surface attacker activity, and the gaps that tell you something was cleaned.

The seven event logs that matter

Event IDs every IR responder memorises

• 4624 — successful logon. Logon Type 3 = network, Type 10 = RDP, Type 2 = interactive, Type 7 = unlock.
• 4625 — failed logon. Bruteforce / spray surfaces here.
• 4634 / 4647 — logoff events.
• 4648 — explicit credential use (“RunAs”). High-signal for lateral movement.
• 4672 — privileged logon. Special-privilege account use.
• 4688 — process creation (with cmdline if audit is configured for cmdline).
• 4720, 4722, 4724, 4732 — account created, enabled, password reset, added to group.
• 4769 — Kerberos service ticket. Kerberoasting requests appear here.
• 4776 — NTLM authentication, often surfacing pass-the-hash attempts.
• 5140, 5145 — share access, detailed share access. Lateral movement surfaces.
• 1102 — security log cleared. The single most-important event in IR.

Finding lateral movement — the 4624 type-3 pattern

Network logons (4624 Logon Type 3) tell the lateral-movement story. The pattern attackers leave:

# PowerShell on a DC — find all network logons by a suspect user in the last 24h
Get-WinEvent -FilterHashtable @{
    LogName='Security'; ID=4624; StartTime=(Get-Date).AddHours(-24)
} | Where-Object { $_.Properties[8].Value -eq 3 -and $_.Properties[5].Value -eq 'suspect.user' } |
  Select-Object TimeCreated, @{N='Source'; E={$_.Properties[18].Value}},
                              @{N='Target'; E={$_.MachineName}}

# Now look at the unique target machines. An admin logging into 30 machines
# in 10 minutes is a lateral-movement pattern.

PowerShell logging — the attacker’s biggest visibility gap

PowerShell 5.1+ supports script-block logging (event 4104). Properly configured, every PowerShell command executed is logged with the full script body — including obfuscated commands that get decoded to plaintext by the logging itself. The gotcha: it must be enabled via Group Policy or registry. The default on a fresh Windows install is off. The first thing to check in any IR is whether 4104 events exist; absence means the attacker’s PowerShell activity is invisible.

The 1102 event — log cleared

Event 1102 fires when the Security log is cleared. Modern attackers know this and avoid clearing if they can. When you see a 1102, three things to do:

1. Capture the timestamp and the account that cleared the log.
2. Look at the System log for surrounding events — most attackers do not also clear System.
3. If WEC (Windows Event Collector) or SIEM forwarded the events earlier, the events live there even after the local log was cleared. Pivot to the SIEM immediately.

The opposite signal — event 1102 absent but a large block of time has no events — is also high-signal. The attacker may have stopped the eventlog service to prevent logging, then restarted it; no clear event, but a gap.

Sysmon — the upgrade you should have

Native Windows event logs miss things Sysmon catches: hash of executed binaries, parent-child process relationships across multiple hops, raw access to disk, network connections by process. Deploy Sysmon with the SwiftOnSecurity config as a baseline; tune from there.

# Install Sysmon
sysmon.exe -accepteula -i sysmonconfig.xml

# Key Sysmon event IDs
# 1  — Process creation (with hash, parent PID, command line)
# 3  — Network connection (per-process)
# 7  — Image loaded (DLL load)
# 10 — Process access (e.g. lsass access for credential dumping)
# 11 — File create
# 13 — Registry value set
# 22 — DNS query

Key takeaways

• Seven logs cover 95% of Windows IR — Security, System, PowerShell/Operational, Sysmon/Operational, TaskScheduler, TerminalServices, Application.
• Logon-Type 3 (network) tells the lateral-movement story; 4648 surfaces explicit credential use.
• 1102 means the Security log was cleared; check WEC / SIEM for forwarded copies.
• PowerShell script-block logging (4104) is invisible unless explicitly enabled.
• Sysmon fills the gaps native logs leave; baseline with SwiftOnSecurity config.